Description
The URL handler in the manual browser option for Gaim before 0.59.1 allows remote attackers to execute arbitrary script via shell metacharacters in a link.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | gaim | 0.58-2.2 | DSA-158 |
Advisories 1
- DSA-158 gaim - arbitrary program execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20020827 GLSA: gaim mailing-list
- HPSBTL0209-067 vendor-advisory
- 5033 vdb-entry
- 5574 vdb-entry
- RHSA-2002:190 vendor-advisory
- RHSA-2002:191 vendor-advisory
- CLA-2002:521 vendor-advisory
- http://gaim.sourceforge.net/ChangeLog
- http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=72728
- RHSA-2003:156 vendor-advisory
- gaim-url-handler-command-execution(9978) vdb-entry
- MDKSA-2002:054 vendor-advisory
- RHSA-2002:189 vendor-advisory
- DSA-158 vendor-advisory